Auto-block admin "hammer" attempts?

bradenmcg — Fri, 25 Feb 2011 19:27:48 GMT

I've been seeing stuff in the system log like the following:

User 'caitlen' failed authentication. Reason: Authentication profile not found for the user From: [some hacker in China's IP].

There are a huge string of these, obviously it's reading through a dictionary and trying a bunch of accounts.

Is there any way to get the PAN to ignore the IP for some period of time after a certain number of failed authentication attempts?

I'm still using the default "Admin" account, is there a document anywhere that would allow me to tie Admin authentication to LDAP or RADIUS, and then am I able to disable the admin account completely?

Re: Auto-block admin "hammer" attempts?

kbrazil — Sat, 26 Feb 2011 00:46:16 GMT

Hi Braden,

You might consider disabling HTTPS and SSH admin access to your device through any of the external L3 interfaces, if possible and only use the out-of-band management interface. Make sure the management interface is behind the firewall and is does not have a publicly routeable or NAT'ed address. If it must be accessible externally, you might consider configuring a security policy that protects the management port with a Vulnerability Protection Profile to help block intrusion attempts. In the 4.0 release you can also enable a "block-ip" action for vulnerability signatures of your choice.

Also, look into configuring specific "permitted IP addresses" on an Interface Management Profile and attaching it to your L3 interface, or configuring permitted IP's on your out-of-band management interface.

Cheers,

Kelly

topic Auto-block admin "hammer" attempts? in General Topics

Auto-block admin "hammer" attempts?

Re: Auto-block admin "hammer" attempts?